topic 10.2 thru 11 Trusted system in Operating System - HP-UX

10.2 thru 11 Trusted system

Waltina L. DiPaolo — Thu, 17 Oct 2002 20:56:38 GMT

is there one easy command that you can type in that will inform the user if the system is in trusted mode or not?

TD

Re: 10.2 thru 11 Trusted system

Jeff Schussele — Thu, 17 Oct 2002 21:38:42 GMT

Hi TD,

I can't think of an easy one that a normal user can run outside of a script to check for the existence of the /tcb/files/auth/r dir or such

Like create a script called trustedy_n containing

if [ -d /tcb/files/auth/r ]
then echo "System IS Trusted"
else echo "System is NOT Trusted"
fi

Then user could run that script & if the /tcb/files/auth/r dir exists (And it will ALWAYS exist on all trusted systems to hold the entry for root) it will echo appropriately.

But I'm not sure if after unconverting the dir still remains....

Else if root users are to run a command - then I'd run
getprpw root
to display root's trusted DB entry settings.

Rgds,
Jeff

Re: 10.2 thru 11 Trusted system

Michael Tully — Thu, 17 Oct 2002 21:39:53 GMT

It is fairly simple.

on a trusted system you will get the usage:
# /usr/lbin/modprdef
Usage: modprdef -m opt=value[,opt=value]

On non-trusted system:
# /usr/lbin/modprdef
System is not trusted

The coding of command checks to see if the system is trusted first before it does anything. There are a few commands in /usr/lbin that will do this.

Re: 10.2 thru 11 Trusted system

S.K. Chan — Thu, 17 Oct 2002 21:45:27 GMT

Run the command ..
# /usr/lbin/modprdef
and it'll tell you but I think only superuser can run it.
Another way is to check the existence of file /tcb/files/auth/system/default. If it exists than the system is trusted. See ..
# man iscomsec
for details.

Re: 10.2 thru 11 Trusted system

Jeff Schussele — Thu, 17 Oct 2002 21:54:20 GMT

S.K. - yep none of the trusted commands are available to "normal" users in /usr/lbin - regardless of perms setting. Believe they're hard-coded that way.

I like the test for default file - but again I wonder if it remains if the system is converted BACK to non-trusted?

Rgds,
Jeff

Re: 10.2 thru 11 Trusted system

Michael Tully — Thu, 17 Oct 2002 22:02:35 GMT

Yes it does check. If you do a 'strings modprdef' it will report 'Not Superuser'

Where is the 'iscomsec' program ? I have the man page but no command....?

Re: 10.2 thru 11 Trusted system

Jeff Schussele — Thu, 17 Oct 2002 22:20:31 GMT

Michael,

Believe it's a function in the /usr/include/prot.h file.

Jeff

Re: 10.2 thru 11 Trusted system

S.K. Chan — Thu, 17 Oct 2002 22:22:37 GMT

It's a system call, not a regular executable. If all iscomsec() is doing is checking for existence of the "default" file to detemine if the system is trusted or not (from the man page), I don;t see why we can't just say "ls /tcb/files/auth/system/default" and if it's there, it's trusted.

Re: 10.2 thru 11 Trusted system

Waltina L. DiPaolo — Fri, 18 Oct 2002 13:14:52 GMT

I have several systems in trusted mode. Don't really want to revert back to test to see of the modprdef still works. Is there a doc you can refer me to, other than the man pages, that will give me a bit more info?

TD

Re: 10.2 thru 11 Trusted system

S.K. Chan — Fri, 18 Oct 2002 13:17:37 GMT

Check out these docs.

http://www.docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/B2355-90121/B2355-90121_top.html&con=/hpux/onlinedocs/B2355-90121/00/00/4-con.html&toc=/hpux/onlinedocs/B2355-90121/00/00/4-toc.html&searchterms=trusted&queryid=20021018-082055

http://www.docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/B2355-90742/B2355-90742_top.html&con=/hpux/onlinedocs/B2355-90742/00/00/66-con.html&toc=/hpux/onlinedocs/B2355-90742/00/00/66-toc.html&searchterms=trusted&queryid=20021018-082055

Re: 10.2 thru 11 Trusted system

Waltina L. DiPaolo — Fri, 18 Oct 2002 16:05:39 GMT

Thanks. I've already read over them. They're not detailed enough. But thanks.

TD

Re: 10.2 thru 11 Trusted system

doug hosking — Sun, 20 Oct 2002 09:31:46 GMT

There is no iscomsec program, but it would be trivial to write one that calls iscomsec and returns an exit status based on the result.
From the iscomsec manual page:

Notes
iscomsec determines if the system is a trusted system or not by
checking the file, /tcb/files/auth/system/default. If the file
exists, then the system is a trusted system. If the file does not
exist, then the system is not a trusted system.